Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
CVE coverage

CVE-2020-1337

CVSS 7.8 3 detections found
View on NVD →
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

Detection rules

Source Rule Status Updated
elastic Suspicious Print Spooler SPL File Created production 2026-10-19
elastic Deprecated - Suspicious PrintSpooler Service Executable File Creation deprecated 2026-08-19
yara HKTL_NET_GUID_CVE_2020_1337 — —